{"id":2425,"date":"2015-09-17T08:42:49","date_gmt":"2015-09-17T05:42:49","guid":{"rendered":"https:\/\/upcloud.com\/global\/us\/resources\/tutorials\/use-ssh-keys-authentication\/"},"modified":"2015-09-17T08:42:49","modified_gmt":"2015-09-17T05:42:49","slug":"use-ssh-keys-authentication","status":"publish","type":"tutorial","link":"https:\/\/upcloud.com\/global\/resources\/tutorials\/use-ssh-keys-authentication\/","title":{"rendered":"How to use SSH keys for authentication"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Set up your first SSH keys<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use <a href=\"https:\/\/upcloud.com\/global\/resources\/tutorials\/managing-ssh-keys\">SSH keys<\/a> for authentication when connecting to or even between your servers. They can greatly simplify and increase the security of your login process. When keys are implemented correctly, they provide a secure, fast, and easy way of accessing your cloud server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Follow our guide and learn how to set up your first SSH keys for authentication using OpenSSH or PuTTY SSH client.<\/p>\n\n\n\n\n\n<h2 class=\"wp-block-heading\">Preparing your server<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To add an SSH key pair, use the following command to create a hidden folder in your user account&#8217;s home directory on your Cloud Server.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mkdir -p ~\/.ssh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then, restrict the permissions to that directory to just yourself using the command below.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">chmod 700 ~\/.ssh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This creates a secure location where you can save your SSH keys for authentication. However, since the keys are stored in your user home directory, every user who wishes to connect using SSH keys for authentication must repeat these steps on their own profile.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/signup.upcloud.com\/\">Try UpCloud for free!<\/a><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Using OpenSSH to generate a key pair<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are using Linux or any other OS with OpenSSH, continue on your computer. PuTTY users should skip to the next section.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Generate a new key pair in a terminal with the next command<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh-keygen -t rsa<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The key generator will ask for the location and&nbsp;file name to which the key is saved. Enter a new name or use the default by pressing enter.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. (Optional) Create a passphrase for the key when prompted<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This simple password will protect your private key should someone be able to get their hands on it. Enter the password you wish, or continue without a password. Press enter twice. Note that some automation tools might not be able to unlock passphrase-protected private keys.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Copy the public half of the key pair to your cloud server using the following command<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Replace the <span style=\"color: #ff0000;\"><tt>user<\/tt><\/span>\u00a0and <span style=\"color: #ff0000;\"><tt>server<\/tt><\/span>\u00a0with your username and the server address on which you wish to use the key authentication.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh-copy-id -i ~\/.ssh\/id_rsa.pub <span style=\"color: #ff0000;\">user<\/span>@<span style=\"color: #ff0000;\">server<\/span><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This also assumes you saved the key pair using the default file name and location. If not, replace the key path\u00a0<tt>~\/.ssh\/id_rsa.pub<\/tt>\u00a0above with your own key name.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enter your user account password for that SSH server when prompted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can now authenticate to your server with the key pair, but you must enter the passphrase every time you connect.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. (Optional) Set up SSH Agent to store the keys to avoid having to re-enter the passphrase at every login<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enter the following commands to start the agent and add the&nbsp;private SSH key.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh-agent $BASH\nssh-add ~\/.ssh\/id_rsa<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When asked, type in your key\u2019s current passphrase. If you saved the private key somewhere other than the default location and name, you must specify it when adding it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Afterwards, you can connect to your cloud server using the keys for authentication and only have to unlock the key by repeating the last 2 steps once after every computer restart.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Using PuTTY to generate a key pair<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are running Windows using the <a href=\"http:\/\/putty.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">PuTTY<\/a> SSH client, you can use PuTTY&#8217;s built-in key generator to create a new key pair.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Click the&nbsp;<em>Keygen<\/em>&nbsp;button<\/strong> at the bottom of the <em>PuTTY Configuration<\/em> window to get started.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/puttytray_keygen-7.png\" alt=\"PuTTYtray key generator\" class=\"wp-image-6723\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Then, in the <em>Key Generator<\/em> window, check that the <em>Type of key to generate<\/em> at the bottom is set to <em>SSH-2 RSA<\/em>. The older SSH-1 was the standard&#8217;s first version but is now considered obsolete. Most modern servers and clients support SSH-2.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Click the <em>Generate<\/em>&nbsp;button<\/strong> to begin.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/puttytray_keygen_generate-7.png\" alt=\"PuTTYtray generate SSH key\" class=\"wp-image-6724\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Keep moving your mouse<\/strong> over the blank area in any manner to help generate randomness for a few moments until the progress is complete.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/puttytray_keygen_generating-7.png\" alt=\"PuTTYtray generating new SSH key\" class=\"wp-image-6725\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">When the keys are finished, PuTTY will show relative information about the pair\u00a0and the public key for easier copying.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. (Optional) Enter a key passphrase<\/strong> in the 2 empty fields for the added security before continuing. The passphrase will protect your key from unauthorized use should someone be able to copy it. However, some automation tools might not be able to unlock passphrase-protected private keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Click the <em>Save private key<\/em>\u00a0button<\/strong> and store it somewhere safe. Generally, anywhere in your user directory is fine if your PC is password-protected. Before closing the keygen, you may want to copy the public key to your clipboard, but you can always get it later as well.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/putty_keygen_save_privatekey-7.png\" alt=\"PuTTYtray save private SSH key\" class=\"wp-image-6726\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Now that you have a new key saved\u00a0on your computer, you must import it into the PuTTY key agent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6. Click the <em>Agent<\/em>&nbsp;button<\/strong> to open the key manager in the PuTTY Configuration window.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/puttytray_agent-7.png\" alt=\"PuTTYtray SSH key agent\" class=\"wp-image-6727\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\"><strong>7. Click\u00a0<\/strong><em><strong>the Add Key<\/strong><\/em><strong>\u00a0button<\/strong>\u00a0in the Key List, then browse to the location where you saved the private key, select it and click\u00a0<em>Open<\/em>.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enter your key passphrase if asked.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/upcloud.com\/media\/puttytray_agent_add_key-7.png\" alt=\"PuTTYtray adding SSH keys\" class=\"wp-image-6728\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This will import the key to your PuTTY client, but you must still copy the public key to your server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>8. Open an SSH connection<\/strong> to your cloud server and go to the SSH key directory.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">cd ~\/.ssh\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>9. Open or create the default file<\/strong> OpenSSH looks for public keys called <tt>authorized_keys<\/tt>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo nano authorized_keys<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>10. Paste the public key into the file<\/strong> by right-clicking the SSH client window. Make sure the key goes on a single line so that OpenSSH can read it. Note that the key type needs to also be included, <tt>ssh-rsa,<\/tt> as shown in the example below.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEeV\/UKOVqNUwmED8PO1E6wY3ITEbWx30rAgGudzTGnYI8fB176nlmIS+O01vaI4fMYwO9Chg3mzVT2+4AkTBm1sXnDdzhNNnkclipMXdmAHnRtzU9kREFZU0\/yyOhorzqxWBi0LQxpjTAZawi+8ysH7PGnNlX3FUObZcmHis0oD\/C7ll6DwX4WVSjh2JGcaIhbhB+sovxW5duTDqyuyKpRsbyBD0+wNjSuJFjh5MnXJqcqrEUaPRoe2wQ9k7q0K2KOXAmYYPUWrLY6N+jjYdnkyP9XWWkz6c7Qvx7m\/dBfgpyJbPryWbSZ8PsvSgtDTIND\/jNfwmgQjOCGgsZlmCsvRIixzh2uNmFCg75wyD6f\/wdZ5gq1HPFdyLblHs46P9ClfMbWJt9APx7c1SRE+qMbdLf\/5\/vNGiGHr6bBXKRX70+XODl04shFQpjm1kKkG9qHkp3bOSot4Da987dRHMhAbd0d3QdS8wCg7s6NPk4qDVnR6BCxiM2vbOD1B4gWQ8= user@server<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When you\u2019ve copied the public key over to the authorized keys list, save the file and exit the editor. You can now test the public key authentication by logging in to your server again. You should not get asked for your password; instead, log in with the key. If it\u2019s not working, check that your private key is unlocked at your SSH Agent and try again.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Turn off password authentication<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">With SSH key authentication configured and tested, you can disable password authentication for SSH altogether to prevent brute-forcing.&nbsp;When logged in to your cloud server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Open the SSH configuration file<\/strong> with the following command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo nano \/etc\/ssh\/sshd_config<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2.&nbsp;Set the password authentication to&nbsp;<em>no<\/em><\/strong>&nbsp;to disable clear text passwords.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">PasswordAuthentication no<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Check that public key authentication is enabled<\/strong> to be safe and not get locked out from your server. If you cannot log in with SSH, you can always use the web terminal in your UpCloud Control Panel.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">PubkeyAuthentication yes<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then save and exit the editor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Restart the SSH service<\/strong> to apply the changes using the below command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo systemctl restart sshd<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With that done, your cloud server is now another step towards security. Malicious attempts to connect to your server will result in authentication rejection, as plain passwords are not allowed, and brute-forcing an RSA key is practically impossible.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Remember to always keep your private keys safe. You can use the same key from multiple computers if\u00a0you wish or generate new ones on each client connecting to your cloud server for added security. Users should generate their key pair and passphrase for secure access control. With proper management, even if one of the private keys gets compromised, you won\u2019t have to replace them all.<\/p>\n","protected":false},"author":3,"featured_media":27382,"comment_status":"open","ping_status":"closed","template":"","community-category":[253],"class_list":["post-2425","tutorial","type-tutorial","status-publish","has-post-thumbnail","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/2425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial"}],"about":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/types\/tutorial"}],"author":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/comments?post=2425"}],"version-history":[{"count":0,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/tutorial\/2425\/revisions"}],"wp:attachment":[{"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/media?parent=2425"}],"wp:term":[{"taxonomy":"community-category","embeddable":true,"href":"https:\/\/upcloud.com\/global\/wp-json\/wp\/v2\/community-category?post=2425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}